Account security
Your account
You can sign in with email and password, a magic link or a social provider, depending on what's enabled for your deployment. All of it is managed under Account.
- Two-factor authentication: turn on TOTP under Account → Security and pair any authenticator app. Recovery codes are shown once; store them somewhere you'll still have access to if you lose your phone.
- Sessions: Account → Sessions lists where you're signed in, with device and last activity. Revoke any you don't recognise; revoking ends them immediately.
- Password: changing it signs out your other sessions.
How your credentials are stored
| Credential | How it's kept |
|---|---|
| Moodle web-service token | Encrypted at rest (AES-256-GCM). Never shown again. |
| MCP key | Only its hash, its last 4 characters and its status. The value is shown once, at creation. |
| Panel secret | Used to verify request signatures; shown once, and can be rotated. |
| License key | Identifies the install. Useless without a valid signature. |
Because the panel keeps hashes rather than values, nobody — not even support — can recover a lost key. Mint a new one and revoke the old.
What protects the connection
- Every request between the plugin and the panel is signed with HMAC-SHA256 and rejected outside a ±5-minute window, which closes the replay window.
- An unknown license and a bad signature return the same error, so the API can't be used to enumerate installs.
- Your Moodle URL is validated against private address ranges, and calls are made with an SSRF-pinned client, with a timeout and a response-size cap.
- MCP credentials are checked on every request, so revocation takes effect on the very next call.
- Tools that delete something ask to be confirmed: called without that confirmation they return a preview and change nothing, so the assistant has to come back to you before anything is removed.
If something is compromised
- A key leaked: revoke it in Organization → Moodle → MCP keys. Its next call will be refused. Mint a replacement.
- The panel secret leaked: rotate credentials in Organization → Moodle and paste the new pair into the plugin.
- An account is compromised: change the password (which signs out other sessions), revoke any remaining sessions, and turn on two-factor authentication.
Owners and admins are notified whenever credentials are rotated, so an unexpected notification is worth investigating rather than dismissing.
Good habits
- One key per person or integration, so revoking one is surgical.
- Read-only by default; grant write access deliberately.
- Set an expiry on anything temporary.
- Review last used in the keys list from time to time and revoke what's gone idle.
- When someone leaves the team, removing them from the organization does not revoke their MCP keys: revoke them separately, as explained in Organizations & members.